How to determine programs that require .net on XP?

[Mayayana]

| .NET Framework 1.1
| The .NET Framework version that was released with Visual Studio .NET
| [VS6 have to have it].....
|

I don't know what the point of this list is, but that
part is not right. VS6 (VB6 and VC6) predates .Net by
about 3 years, and is used to write normal compiled
software. It has nothing to do with any .Net Frameworks.

 

[aeroloose]

Here's an easy, simple tool to check for .Net software.
It's an HTA. (VBScript that runs in an IE webpage.)
The tool is not dangerous and does not itself require
.Net or any other additional software. You just give it
a folder path and it will check all EXEs and DLLs,
reporting the full path and .Net version for any file that
requires .Net. It doesn't run or write to any files it finds.
It works by just reading the file header to get data
stored there.

Download:
http://www.jsware.net/jsware/test/dotnetv.zip

Here's a picture:
http://www.jsware.net/jsware/test/dncheck.gif

There are directions in the HTA webpage interface.
And the generated list can be copied. .Net software
can be identified by the file paths. It's very simple.

This still hasn't been tested on Win64. It should
work, but I'm not certain that Win64 EXE headers
are exactly the same format as Win32 EXEs. I would
appreciate any reports.

Interesting side note: The sample image shows a test
running on XP with no .Net installed. Some of the list
is software I downloaded for testing. But one item on
there is the Microsoft Management Console. MMC is
something that seems to be designed for corporate
admins. I've never used it. Strangely, MS seems to
have converted that to .Net in XP, as a default install,
even though XP does not have .Net by default!

Thank you. I'll give it a try this weekend.

 

[aeroloose]

Thank you. I'll give it a try this weekend.

I ran it, with interesting results. I have 8 programs that
use it (not counting the v2 and v3 Frameworks themselves).
I did not expect to see Firefox and Thunderbird show up, but
they did. The others were Silverlight, PDF995, Filehippo
Updater, Wireshark, SyncToy and Installshield (the only v1
reference).

I did have problems running the HTA script. I tried the
"c:\windows" path first, but after clicking through many
"Program is slowing. Stop this script?" error messages, it
finally ground to a halt. After killing and restarting, I
tried with "c:\program files." I still had lots of
click-throughs, but it finally completed. I don't know if
this is a function of the age of my machine, IE7, or
something else.

Thanks for the reco.

 

[BillW50]

I ran it, with interesting results. I have 8 programs that use it (not
counting the v2 and v3 Frameworks themselves). I did not expect to see
Firefox and Thunderbird show up, but they did. The others were
Silverlight, PDF995, Filehippo Updater, Wireshark, SyncToy and
Installshield (the only v1 reference).

I did have problems running the HTA script. I tried the "c:\windows"
path first, but after clicking through many "Program is slowing. Stop
this script?" error messages, it finally ground to a halt. After killing
and restarting, I tried with "c:\program files." I still had lots of
click-throughs, but it finally completed. I don't know if this is a
function of the age of my machine, IE7, or something else.

Thanks for the reco.

I too had similar results.

 

[Mayayana]

| I did not expect to see Firefox and Thunderbird show up, but
| they did. The others were Silverlight, PDF995, Filehippo
| Updater, Wireshark, SyncToy and Installshield (the only v1
| reference).

I'm surprised about FF and TB, too. Maybe there are some
kind of plugins? I have FF3.6 with no .Net. And since FF is
OSS it's hard to imagine anything inherent to the browser
that requires .Net. Silverlight, Filehippo and SyncToy are
not surprising. Installshield is something I also have. There are
..Net files, but it doesn't need .Net. IS just stores a lot of
junk on any PC where IS installers have been run.

|
| I did have problems running the HTA script.

Does the readme.txt file have a version number near the
top? v. 1.13.12.2
I made a slight tweak. That's the latest version. The first
version was based on some faulty info. It will work fine and
will find the vast majority of .Net files, but I discovered
that it won't find some MS files that have an unusual format.


| I tried the
| "c:\windows" path first, but after clicking through many
| "Program is slowing. Stop this script?" error messages, it
| finally ground to a halt.

Ahhh. That's a pain in the neck. See here:

http://www.jsware.net/jsware/scripts.php5#ie7prob

The download there is a small script that changes a setting
to stop that behavior. IE asks whether you want to keep
letting a long script run, but then it doesn't listen to your
answer. It just asks over and over!

Thanks for the feedback. I'll release this to the public
but these kinds of things are hard to test extensively
by myself. (Maybe I'll also include a copy of the script
to fix the IE nags. I didn't think of that, but I think a lot
of people run into that problem, and the solution is obscure.)

 

[BillW50]

| I did not expect to see Firefox and Thunderbird show up, but
| they did. The others were Silverlight, PDF995, Filehippo
| Updater, Wireshark, SyncToy and Installshield (the only v1
| reference).

I'm surprised about FF and TB, too. Maybe there are some
kind of plugins? I have FF3.6 with no .Net. And since FF is
OSS it's hard to imagine anything inherent to the browser
that requires .Net...

I seem to recall during at least one Firefox update (I skipped that one)
that dotnet was automatically installed. There was a huge outcry in the
Mozilla community about Microsoft forcing it on them. But I don't think
it was all Microsoft doing. As I think Mozilla was somewhat responsible.

 

[aeroloose]

| I did not expect to see Firefox and Thunderbird show up, but
| they did. The others were Silverlight, PDF995, Filehippo
| Updater, Wireshark, SyncToy and Installshield (the only v1
| reference).

I'm surprised about FF and TB, too. Maybe there are some
kind of plugins? I have FF3.6 with no .Net. And since FF is
OSS it's hard to imagine anything inherent to the browser
that requires .Net. Silverlight, Filehippo and SyncToy are
not surprising. Installshield is something I also have. There are
.Net files, but it doesn't need .Net. IS just stores a lot of
junk on any PC where IS installers have been run.

For FF9 and TB9, it's the same file, in the root folder of
both programs: msvcm80.dll. DAGS shows linkage to MS Visual
Studio 2005. TB doesn't seem to have plug-ins, and I don't
have a common add-on between the two programs. Perhaps it's
a Mozilla inclusion, not specific to FF or TB?

|
| I did have problems running the HTA script.

Does the readme.txt file have a version number near the
top? v. 1.13.12.2

Yes, that's the version in the readme.

I made a slight tweak. That's the latest version. The first
version was based on some faulty info. It will work fine and
will find the vast majority of .Net files, but I discovered
that it won't find some MS files that have an unusual format.


| I tried the
| "c:\windows" path first, but after clicking through many
| "Program is slowing. Stop this script?" error messages, it
| finally ground to a halt.

Ahhh. That's a pain in the neck. See here:

http://www.jsware.net/jsware/scripts.php5#ie7prob

The download there is a small script that changes a setting
to stop that behavior. IE asks whether you want to keep
letting a long script run, but then it doesn't listen to your
answer. It just asks over and over!

I'll try that. However, I wonder if it'll still eventually
lock-up; I just won't see the script nags?

Thanks for the feedback. I'll release this to the public
but these kinds of things are hard to test extensively
by myself. (Maybe I'll also include a copy of the script
to fix the IE nags. I didn't think of that, but I think a lot
of people run into that problem, and the solution is obscure.)

YW

 

[Paul]

For FF9 and TB9, it's the same file, in the root folder of both
programs: msvcm80.dll. DAGS shows linkage to MS Visual Studio 2005. TB
doesn't seem to have plug-ins, and I don't have a common add-on between
the two programs. Perhaps it's a Mozilla inclusion, not specific to FF
or TB?

Could you use DependencyWalker to check what is going on ?

I don't know, when a DLL is stamped with .NET, whether that
guarantees it has to load all that stuff when accessed. I have
some software here, that only includes a subset of the msv**90
stuff, so maybe the file isn't used ? Perhaps if you use
DependencyWalker, the information will be there.

http://en.wikipedia.org/wiki/Dependency_Walker

"It only shows the load-time dependencies; it is not possible
to know every run-time dependency without disassembling or
executing the program."

If the program itself loads dotnet, then you'd likely see a reference
to mscoree. But if some DLL is doing that, I don't know if the same
would (eventually) show up somewhere in the dependency tree.

I'm still trying to find a file that I know for absolutely sure,
is x64 and .NET, to try as a test case. I tried Mayayana's script
for a quick check, but I'm still looking for enough code samples to
make some good tests. I backed up my x64 laptop, installed paint.net, but the
executable there was PE32 and not PE32+, so won't make a good test
case for me. And in Googling to see if anyone made a set of test
executables, I wasn't able to convince the search engine to find
something relevant along those lines.

Paul

 

[Mayayana]

| For FF9 and TB9, it's the same file, in the root folder of
| both programs: msvcm80.dll. DAGS shows linkage to MS Visual
| Studio 2005.

Interesting. That's the VC++ 8 managed runtime.
There's another one called mfcm80.dll. I think those are
both installed with the VC8 runtime, as one of several
files, in case anyone wants to write C++-CLI software.
(I don't think anyone actually does. Writing managed
C++ defeats the purpose.)

In other words, it means that they installed the VC++8
runtime, which is not surprising as most people writing
C++ software on Windows use Visual Studio, and VS
software always requires a runtime. As long as no other
..Net files are in the program it doesn't use .Net. I'll have
to add a note about that to the utility.

| > Ahhh. That's a pain in the neck. See here:
| >
| > http://www.jsware.net/jsware/scripts.php5#ie7prob
| >
| > The download there is a small script that changes a setting
| > to stop that behavior. IE asks whether you want to keep
| > letting a long script run, but then it doesn't listen to your
| > answer. It just asks over and over!
|
| I'll try that. However, I wonder if it'll still eventually
| lock-up; I just won't see the script nags?
|

No, it's just that it takes awhile to process so many files,
and IE has a default time limit. In other words, it's not
locked up. It's just busy. I've had that problem in the past
with HTA scripts that do extensive operations. That's how
I know about the Registry setting. If IE did lock up you
could use Task Manager to kill it, but in this case it's just
that IE normally expects scripts that run for a fraction of
a second, so it just assumes there's a problem. That's not
so bad. But then Microsoft messed up by programming it
so that IE ignores your response to the message window.
So a slightly helpful feature is instead a hair-pulling bug.

I'm glad you asked about all this. Now that I've written the
utility I can see it being very useful when cleaning up other
people's machines -- as a quick way to see whether .Net can
be removed.

I just uploaded another update. It's not really significant,
but it did recognize an oddball file in Open Office 3 (even
though OO doesn't need .Net) that the last version didn't
pick up.

Technical explanation, for anyone who's curious:

I wrote the original version on the basis of information I'd
found that the .Net header in a PE file starts 8 bytes into
the .text section. It turned out that was wrong. Apparently
..Net software written in Visual Studio is like that, so 95+ %
of .Net files will be like that, but I later found a couple of MS
files that have the table later in the .text section. Then I
decided that maybe I shouldn't even assume the .Net header
is in the .text section at all. And wouldn'cha know it....
Turns out the OO people wrote such a file.
It may be the only such file in existence for all I know, but
the latest version of the utility was worth doing just in case.
It's more "robust", as the geeks like to say. Now, if it finds
..Net header info. in a file, it makes no assumptions about
where in the file that header will be located.

 

[Mayayana]

| I seem to recall during at least one Firefox update (I skipped that one)
| that dotnet was automatically installed.

See my resonse below. It's just a file that's included
with the VC++8 runtime, but is unlikely to be used by
anything. (If FF actually needed .Net there would be
..Net DLLs as part of FF itself.)

 

[BillW50]

| I seem to recall during at least one Firefox update (I skipped that one)
| that dotnet was automatically installed.

See my resonse below. It's just a file that's included
with the VC++8 runtime, but is unlikely to be used by
anything. (If FF actually needed .Net there would be
.Net DLLs as part of FF itself.)

I am still very fuzzy about what the deal was. But some of it came back
a bit afterwords. And that was if you had some versions of Firefox and
did an automatic Windows update, it added some Firefox add-on that I
thought (maybe incorrectly) had something to do with dotnet.

I did a quick Google search and this might have been what I am thinking
of and it has nothing to do with dotnet like I first thought. But still
noteworthy nonetheless.

Microsoft hides mystery Firefox extension in toolbar update
http://arstechnica.com/microsoft/ne...ips-ie-firefox-add-on-into-toolbar-update.ars

 

[aeroloose]

<snip>

FYI. I can't get to your links above via IE. Ironic, yes?
The browser I need to run the file, won't let me fetch it
. I get the following (abridged) error message: "IE
cannot download ... IE was not able to open the site. The
requested site is either unavailable or cannot be found.
Please try again later." When I switch to FF, it works
fine. I tried this several times during the day, with same
results.

Thought you should know. It's probably my settings, but
this message is unfamiliar.

 

[Mayayana]

| FYI. I can't get to your links above via IE. Ironic, yes?
| The browser I need to run the file, won't let me fetch it
| . I get the following (abridged) error message: "IE
| cannot download ... IE was not able to open the site. The
| requested site is either unavailable or cannot be found.
| Please try again later." When I switch to FF, it works
| fine. I tried this several times during the day, with same
| results.
|
| Thought you should know. It's probably my settings, but
| this message is unfamiliar.

Thanks. I don't think I've ever seen such a message either.
It doesn't sound like a DNS issue, since it's not a 404 error.
Rather, it sounds like IE is not getting a response from the
server. I don't know how that could happen for one browser
and not another.

I wonder if it might be IE security, trying to open an index
page at the URL rather than directly accepting binaries. That
doesn't really make sense, either, but it's the only explanation
I can think of. (The test\ folder has no pages. Just a few
ZIP files.)

 

[000-222-000]

<snip>

FYI. I can't get to your links above via IE. Ironic, yes? The browser I need to run the file, won't let me fetch it . I get
the following (abridged) error message: "IE cannot download ... IE was not able to open the site. The requested site is either
unavailable or cannot be found. Please try again later." When I switch to FF, it works fine. I tried this several times during
the day, with same results.

Thought you should know. It's probably my settings, but this message is unfamiliar.

< http://www.jsware.net/jsware/ditips.php5#downl >
Downloading
For most of the software here you can just download the "EXE" installer file and double-click it to install the software.

Download Difficulties?
. Problems Specific to Internet Explorer - If you use Internet Explorer you might see a warning that the download may not be
"trustworthy". You can ignore that warning. It is caused by excessive restrictions built into Internet Explorer. (See this page for
more explanation and ways to stop being nagged by spurious IE "security" warnings.)

In some cases when using Internet Explorer, your download may even be blocked "for your safety". That behavior can be adjusted
if you want to keep using IE. (See link above.) We recommend that you just switch to using the Firefox or Opera browser instead.
Fixing the increasing nags, restrictions and security problems with Internet Explorer is not an easy endeavor. It requires that you
familiarize yourself with the convoluted IE security settings and that you adjust undocumented Registry settings.

 

[Motor T]

| FYI. I can't get to your links above via IE. Ironic, yes?
| The browser I need to run the file, won't let me fetch it
| . I get the following (abridged) error message: "IE
| cannot download ... IE was not able to open the site. The
| requested site is either unavailable or cannot be found.
| Please try again later." When I switch to FF, it works
| fine. I tried this several times during the day, with same
| results.
|
| Thought you should know. It's probably my settings, but
| this message is unfamiliar.

Thanks. I don't think I've ever seen such a message either.
It doesn't sound like a DNS issue, since it's not a 404 error.
Rather, it sounds like IE is not getting a response from the
server. I don't know how that could happen for one browser
and not another.

I wonder if it might be IE security, trying to open an index
page at the URL rather than directly accepting binaries. That
doesn't really make sense, either, but it's the only explanation
I can think of. (The test\ folder has no pages. Just a few
ZIP files.)

I clicked the link this morning. Opened in my default browser (Opera)
but got a'invalid image' message of some sort. This message
disappeared immediately however, and the 'download to:' window opened.
The script downloaded fine. I extracted and simply hit the
DotNetChecker.hta app. and it ran fine. Don't know how or why it
worked this way and I don't care. All I know is it worked just fine.
Thanks for doing this.

 

[Mayayana]

I found this:

Tools menu-> Internet Options-> Advanced tab
Go to the Security section all the way at the bottom.
Clear the check on the "Do not save encrypted pages to disk"

Apparently in some cases if a link to a binary is put
into the IE address bar (rather than coming from an
in-page link) it's treated as an encrypted webpage?
If so, that's got to be about the most misleading
error message I've ever seen!

 

[aeroloose]

I found this:

Tools menu-> Internet Options-> Advanced tab
Go to the Security section all the way at the bottom.
Clear the check on the "Do not save encrypted pages to disk"

Apparently in some cases if a link to a binary is put
into the IE address bar (rather than coming from an
in-page link) it's treated as an encrypted webpage?
If so, that's got to be about the most misleading
error message I've ever seen!

Drat! Mine was already unchecked. I think you're on to
something, but I don't know where to look next.

 

[aeroloose]

< http://www.jsware.net/jsware/ditips.php5#downl >
Downloading
For most of the software here you can just download the
"EXE" installer file and double-click it to install the
software.

Download Difficulties?
. Problems Specific to Internet Explorer - If you use
Internet Explorer you might see a warning that the download
may not be "trustworthy". You can ignore that warning. It is
caused by excessive restrictions built into Internet
Explorer. (See this page for more explanation and ways to
stop being nagged by spurious IE "security" warnings.)

In some cases when using Internet Explorer, your download
may even be blocked "for your safety". That behavior can be
adjusted if you want to keep using IE. (See link above.) We
recommend that you just switch to using the Firefox or Opera
browser instead. Fixing the increasing nags, restrictions
and security problems with Internet Explorer is not an easy
endeavor. It requires that you familiarize yourself with the
convoluted IE security settings and that you adjust
undocumented Registry settings.

Thanks, but I didn't see these message types. It's more of
the "can't find it" problem, not the "it's not safe" problem.

 

[Mayayana]

| I'm still trying to find a file that I know for absolutely sure,
| is x64 and .NET, to try as a test case.

I haven't been able to test this yet, but I did find one
thing different: The 64-bit Directory Table is different.
The 1st 2 bytes of the optional header indicate a 32
or 64 bit PE file. For 64-bit there are some small differences,
with the result that while the .Net header is 208 bytes
into the optional header for 32-bit, it's a 224 byte offset
for 64-bit files. There doesn't appear to be any difference
in the actual header itself, but I'm not certain about that. If
the directory table offset is the only issue it will be very
easy to accomodate both file types.

 

[Mayayana]

Just posting the final URL for the DotNet Checker
utility, for people who may find this thread via
search:

http://www.jsware.net/jsware/scripts.php5#peops

(The original link was for a test version. That link
is no longer valid.)